CVE-2020-16123: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2020-16123 is a vulnerability discovered in PulseAudio's Ubuntu-specific patch that created a race condition in the snap policy module. The issue was discovered by James Henstridge on September 17, 2020, and affects the PulseAudio sound server's handling of snap client connections. The vulnerability impacts multiple Ubuntu versions including 20.10, 20.04 LTS, 18.04 ESM, and 16.04 ESM (Ubuntu Notice).

The vulnerability occurs when the snap policy module fails to identify a client connection from a snap if SCM_CREDENTIALS are missing from the PA_COMMAND_AUTH request. This happens due to a race condition between the client sending the PA_COMMAND_AUTH request and the server calling setsockopt(). If the client wins this race, the server receives a message with empty SCM_CREDENTIALS control message (pid=0, uid=65534, gid=65534), causing the module to incorrectly determine that the client is not a snap (Launchpad Bug).

When exploited, this vulnerability allows a snap to connect to PulseAudio without proper confinement, potentially exposing sensitive information. The issue is particularly problematic because the system was reducing privilege on a match rather than increasing it, making it possible for snaps to bypass intended access restrictions (Launchpad Bug).

The vulnerability can be triggered by a malicious program using an alternative client library that doesn't set SO_PASSCRED on their sockets. Testing demonstrated that repeated attempts to exploit this condition would occasionally succeed in bypassing the snap confinement, allowing unauthorized access to PulseAudio functionality (Launchpad Bug).

The issue has been fixed in multiple Ubuntu versions with the following releases: 1:13.99.3-1ubuntu2, 1:13.99.2-1ubuntu2.1, 1:13.99.1-1ubuntu3.8, 1:11.1-1ubuntu7.11, and 1:8.0-0ubuntu3.15. The fix involves using aa_getpeercon() to retrieve the peer's AppArmor label at connection time and storing it in the pa_client struct, rather than relying on the previous SCM_CREDENTIALS method (Ubuntu Notice).